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DETAILED ACTION 

1 . The instant application having Application No. 1 0/702408 has a total of 29 claims 
pending in the application, there are 3 independent claims and 26 dependent claims, all 
of which are ready for examination by the examiner. 

II. INFORMATION CONCERNING OATH/DECLARATION 

Oath/Declaration 

2. The applicant's oath/declaration has been reviewed by the examiner and is found 
to conform to the requirements prescribed in 37 C.F.R. ' 1.63. 

III. INFORMATION CONCERNING DRAWINGS 

Drawings 

3. The applicant's drawings submitted 06 November 2003 are acceptable for 
examination purposes, but several deficiencies, observed by the draftsman, exist with 
respect to their form and are indicated on the PTOL-948 accompanying the instant 
office action (See M.P.E.P. ' 707.07(a)). 

IV. ACKNOWLEDGEMENT OF REFERENCES CITED BY APPLICANT 

Information Disclosure Statement 

4. As required by M.P.E.P. ' 609 (C), the applicant's submission of the Information 
Disclosure Statement dated 27 September 2004 is acknowledged by the examiner and 
the cited references have been considered in the examination of the claims now 
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pending. As required by M.P.E.P. ' 609 C(2) f a copy of the PTOL-1449 initialed and 
dated by the examiner is attached to the instant office action. 

V. OBJECTIONS TO THE APPLICATION 

Abstract 

5. The abstract of the disclosure is objected to because of the following 
informalities: 

6. In Line 1 the abstract reads, "Analyzing data on a network." This is not a 
complete sentence therefore grammatically incorrect. 

7. Correction is required. See MPEP § 608.01(b). 

VI. REJECTIONS NOT BASED ON PRIOR ART 

Claim Rejections - 35 USC ' 112 

8. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

9. Claims 2, 21 , and 23 are rejected under 35 U.S.C. 1 12, first paragraph, as failing 
to comply with the enablement requirement. The claim(s) contains subject matter which 
was not described in the specification in such a way as to enable one skilled in the art to 
which it pertains, or with which it is most nearly connected, to make and/or use the 
invention. 
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10. Regarding Claims 2, 21, and 23, in Line 3 of Claim 2, Line 2 of Claim 21, and 
Line 4 of Claim 23 a reference is made to "graphing byte density over time". Byte 
density is not adequately described in the disclosure. For the purposes of further 
examination the Examiner will interpret "graphing byte density over time" as "graphing 
network traffic over time". 

VII. REJECTIONS BASED ON PRIOR ART 

Claim Rejections - 35 USC ' 103 

1 1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

12. Claims 1-6, 9-11, and 13-29 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cook et al. (herein Cook (US Patent No. 6,965,574)) and further in 
view of Leftwich (US Patent No. 6,356,256). 

13. Regarding Claim 1, Cook discloses A method of analyzing network traffic on a 
network, the network traffic having been captured at a network monitoring computer 
during a period of time, the method comprising: at a user computer remote from the 
network monitoring computer, receiving data points corresponding to the captured 
network traffic, the data points comprising: for the captured network traffic, start time, 
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end time, total frames and total bytes; and information about sections of the captured 
network traffic, the information including start time, end time, number of frames in the 
section and number of bytes in the section. (See Cook: Figure 3) 

Cook fails to disclose storing a histogram, including the data points, at the user 
computer. 

Leftwich discloses storing a histogram, including the data points, at the user 
computer. (See Leftwich: Figure 4 and 3B) 

Cook: Figure 3 shows the organization of network traffic. The number of 
packets, number of bytes, flow start and end time are all present in the network 
traffic information. Knowing the flow start time and end time gives you the total 
clock ticks of the capture. In Leftwich: Figure 4 the graph contains tabs for usage 
statistics and burst management. These would be relating specifically to network 
traffic. In Leftwich: Figure 3B it is shown in the picture that the graphical user 
interface is connected across a network to the data gathering mass storage 
device, therefore making it remote. 

Cook and Leftwich are analogous art because they are from the same field of 
endeavor, presenting communication performance history data. 

At the time of invention it would have been obvious to one of ordinary skill in the 
art to use the graphical display of Leftwich to display the network traffic data of Cook. 

The motivation for doing so would have been to make information easily 
perceivable by a user. (Leftwich: Column 1, Lines 28-31) 



Application/Control Number: 10/702,408 Page 6 

Art Unit: 2188 

Therefore, it would have been obvious to combine the graphical display of 
Leftwich with the network traffic data collecting system of Cook for the benefit of making 
information easily perceivable by a user to obtain the invention as specified in claim 1. 

14. Claim 2 is rejected using the same rationale as Claim 1. 

15. Regarding Claim 3, Leftwich discloses presenting a user with a graphical user 
interface representation of the network traffic comprises: including a zoom window, the 
zoom window useful for highlighting a segment of the capture histogram, and 
representing the segment of the capture histogram in a zoom histogram. 

(See Leftwich: Figure 5A and 5B also See Leftwich: Column 5, Lines 44-51) 
The user clicks and drags to create a zoom window and the zoom is then 
displayed as a response to the user input. 

16. Regarding Claim 4, Leftwich discloses including a data selection window useful 
for highlighting a segment of the zoom histogram; storing a first downloaded captured 
data file that includes sections corresponding to the segment of the zoom histogram 
highlighted by the data selection window; and displaying data frames corresponding to 
the highlighted segment of the zoom window. 

(See Leftwich: Column 5, Lines 37-42) The cursor is used to select a 
segment. Then the data points corresponding to the selection are shown in the 
histogram window, Figure 4, Element 36. 

17. Claim 5 is rejected using the same rationale as Claim 4. 

18. Claim 6 is rejected using the same rationale as Claim 1. 
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19. Regarding Claim 9, Cook discloses the histogram further comprising a listing 
and description of downloaded captured data files stored on the user computer, the 
method further comprising using the listing and description of downloaded captured 
data files to code portions of the capture histogram and the zoom histogram with a first 
indicator representing sections stored at the user computer. 

The system locates the files when it needs to access them for processing 
and displaying. Therefore, the system must contain indicators to locate the files it 
is using. 

20. Claim 10 is rejected using the same rationale as Claim 9. 

21. Claim 11 is rejected using the same rationale as Claim 9. 

22. Regarding Claim 13, Cook discloses downloading sections from the network 
monitoring computer that are not stored in downloaded captured data files at the user 
computer; and combining the downloaded sections with a downloaded captured data 
file that was previously stored at the user computer. 

The original files were taken from the network monitoring computer and 
used at the graphical user interface of the user computer to generate the 
histogram. If specific files or data is requested that is not at the user computer 
the network monitoring computer is still fully capable of providing data. 

23. Regarding Claim 14, Cook discloses saving the histogram for later use. 
See Cook: Column 6, Lines 43-44. Cook discloses storing the data in 

persistent storage. 
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24. Regarding Claim 15, Cook discloses opening the histogram; determining if the 
histogram corresponds to network traffic stored on the network monitoring computer 
using timestamps; if the histogram corresponds to network traffic stored on the network 
monitoring computer, establishing a relationship between the network monitoring 
computer and the user computer such that network traffic existing on the network 
monitoring computer may be downloaded to the user computer. 

See Cook: Column 6, Lines 43-44. Cook discloses storing the data in 
persistent storage. If the system can store the data it also will be able to open the 
stored files. 

The original files were taken from the network monitoring computer and 
used at the graphical user interface of the user computer to generate the 
histogram. If the saved file opens and specific files or data that is requested is 
not at the user computer the network monitoring computer is still fully capable of 
providing data 

25. Claim 16 is rejected using the same rationale as Claim 14. 

26. Claim 17 is rejected using the same rationale as Claim 1. 

27. Claim 18 is rejected using the same rationale as Claim 1. 

28. Claim 19 is rejected using the same rationale as Claim 1. 

29. Claim 20 is rejected using the same rationale as Claim 1. 

30. Claim 21 is rejected using the same rationale as Claim 1. 

31. Claim 22 is rejected using the same rationale as Claim 13. 

32. Claim 23 is rejected using the same rationale as Claim 1. 



Application/Control Number: 10/702,408 Page 9 

Art Unit: 2188 

The Examiner takes Official Notice that a top-level folder for organizing 
data fields into a file structure, along with the naming of the files, folders, etc. that 
are associated with the file structure, would be obvious to a person of ordinary 
skill in the art. Many operating systems that have been used and that are used 
today include this function. 

33. Regarding Claim 24 is rejected using the same rationale as Claim 23. 

34. Regarding Claim 25 is rejected using the same rationale as Claim 23. 

35. Regarding Claim 26 is rejected using the same rationale as Claim 23. 

36. Regarding Claim 27 is rejected using the same rationale as Claim 23. 

37. Regarding Claim 28 is rejected using the same rationale as Claim 15. 

38. Regarding Claim 29 is rejected using the same rationale as Claim 1. 

39. Claims 7 and 8 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Cook et al. (herein Cook (US Patent No. 6,965,574)), Leftwich (US Patent No. 
6,356,256), and further in view of Mazumder (US Patent No. 6,580,959). 

40. Regarding Claim 7, Cook and Leftwich disclose presenting a user with a 
graphical user interface representation of the network traffic. 

Cook and Leftwich fail to disclose applying a compression algorithm to at least a 
portion of the information in the histogram. 

Mazumder discloses applying a compression algorithm to at least a portion of the 
information in the histogram. 
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Mazumder teaches using an efficient compression algorithm to enable fast 
transmission of a file. (Mazumder: Column 2, Lines 24-27) 

Cook, Leftwich, and Mazumder are analogous art because they are from the 
same field of endeavor, data monitoring and processing. 

At the time of the invention it would have been obvious to a person of ordinary 
skill in the art to compress the histogram information of Cook and Leftwich with the 
compression algorithm of Mazumder. 

The motivation for doing so would have been to enable efficient and fast 
transmission over a network. (Mazumder: Column 2, Lines 24-27) 

Therefore it would have been obvious to combine the compression algorithm of 
Mazumder with the data monitoring and display system of Cook and Leftwich for the 
benefit of fast and efficient transmission over a network to obtain the invention as 
specified in claim 5. 

41 . Claim 8 is rejected using the same rationale as Claim 7. 

42. Claim 12 is rejected under 35 U.S.C, 103(a) as being unpatentable over Cook et 
al. (herein Cook (US Patent No. 6,965,574)), Leftwich (US Patent No. 6,356,256), and 
further in view of Jamieson et al. (herein Jamieson (US Patent No. 6,577,323)). 

Regarding Claim 12, Cook and Leftwich fail to disclose using the listing and 
description of downloaded captured data files to color code portions of the capture 
histogram and the zoom histogram with a first color representing sections stored at the 
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user computer, color coding portions of the capture histogram and the zoom histogram 
with a second color representing sections that were previously at the user computer, but 
that are not presently at the user computer; and color coding portions of the capture 
histogram and the zoom histogram with a third color representing sections that are not 
stored at the user computer or at the network monitoring computer. 

Jamieson discloses using the listing and description of downloaded captured 
data files to color code portions of the capture histogram and the zoom histogram with a 
first color representing sections stored at the user computer, color coding portions of the 
capture histogram and the zoom histogram with a second color representing sections 
that were previously at the user computer, but that are not presently at the user 
computer; and color coding portions of the capture histogram and the zoom histogram 
with a third color representing sections that are not stored at the user computer or at the 
network monitoring computer. 

See Jamieson: Column 6, Line 60 - Column 7, Line 3. Jamieson teaches the 
use of color coding a graph according to varying indicators. The indicators may 
representative of many things. An indicator of data location is already part of the 
data file (see rejection rationale of Claim 7). The data plot can then be color coded 
according to data location. 

Cook, Leftwich, and Jamieson are analogous because they are from the same 
field of endeavor, data presentation. 
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At the time of the invention it would have been obvious to one of ordinary skill in 
the art to combine the color coded background of Jamieson (Jamieson: Column 6, 
Line 64 - Column 7, Line 3) with the data plots of Cook and Leftwich. 

The motivation for doing so would have been to easily provide additional 
information to the user and to possibly to provide navigation to more detailed 
information. (Jamieson: Column 6, Line 64 - Column 7, Line 3) 

43. Therefore it would have been obvious to combine the color coded background of 
Jamieson with the data plots of Cook and Leftwich for the benefit of providing additional 
information to the user and possibly providing navigation to more detailed information to 
obtain the invention as specified in Claim 12. 

VIII. RELEVANT ART CITED BY THE EXAMINER 

44. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure: 

The following references teach methods for acquiring and monitoring 
network traffic data: 

Baker et al. (US Patent No. 6,266,700) 
Sufleta (US Patent No. 6,785,237) 
Cafarelli et al. (US Patent No. 6,760,845) 

The following references teach methods of displaying data collections using a 
graphical user interface and possessing zoom functionality: 



Application/Control Number: 10/702,408 Page 13 

Art Unit: 2188 

Baker et al. (US Patent No. 5,953,006) 
Wichelman (US Patent No. 6,785,540) 



IX. CLOSING COMMENTS 

Conclusion 

a. STATUS OF CLAIMS IN THE APPLICATION 

45. The following is a summary of the treatment and status of all claims in the 
application as recommended by M.P.E.P. 1 707.07(i): 

a(1). CLAIMS REJECTED IN THE APPLICATION 

46. Per the instant office action, claims 1-29 have received a first action on the merits 
and are subject of a first action non-final. 

b. DIRECTION OF FUTURE CORRESPONDENCES 

47. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael B. McFadden whose telephone number is 
(571)272-8013. The examiner can normally be reached on Monday-Friday 8:30 - 5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Manorama Padmanabhan can be reached on (571)272-4210. The fax 
phone number for the organization where this application or proceeding is assigned is 
571-273-8300. 
IMPORTANT NOTE 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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02/24/2006 




